I've got several machines authenticating against AD via winbind. What I would like to do is map Domain Users to various local groups, eg. audio, video, cdrom, etc. Is this possible and if so, what is the correct/preferred way?